How to configure Telus Optik IPv6 on a Ubiquiti Edgerouter

After switching to Telus Optik, I wanted to take advantage of Telus IPv6 support, using my Ubiquiti Edgerouter Lite. After a lot of googling, I was able to put enough pieces together to get full IPv6 working across my network. This configuration will work with EdgeOS 1.9.0, and should work with versions of EdgeOS going back at least to 1.7.0.

Note: I am running my Edgerouter with eth0 connected to WAN, which is connected to the Telus router, in bridge mode. The Edgerouter’s eth1 is connected to LAN, and eth2 is connected to WLAN (a wireless AP). There are a few peculiarities to the way Telus provides IPv6 addresses that make standard router configurations problematic. It’s worthwhile to read this comment from a Telus employee:

“Now if you want to use your own router, you can do what you mentioned by using the port 1 bridge mode on the Actiontec and connecting your device into this. It will work fine, however there are a few issues with a majority of 3rd party devices. In order for it to work your device must:

1. Only request a dhcp6-pd (So only send IA-PD in the dhcp6 solicit message). This is what the Actiontecs actually do.

2. If the device does request both an IA-NA, and an IA-PD in the solicit message, then it must conform to RFC 7550. We are not using IA-NA so in our dhcp Advertise message there will be a NoAddrAvail message for the IA-NA, and a prefix for the IA-PD.

#2 is where most of the 3rd party devices have issues. They don’t handle this case and will usually reject the dhcp advertise message that is sent down and just go into and endless solicit loop.”

If your Edgerouter isn’t configured to “only request a dhcp6-pd” and not request an IA-NA, your router’s CPU usage will jump to 100% as the dhcp6-pd log is flooded with denied IA-NA messages. To get around this, you MUST set the Edgerouter WAN interface’s dhcpv6-pd option to “prefix-only”.

Also, if you are running your LAN (local ports) in bridged mode, you don’t assign IPv6 addresses to your ethernet ports. Instead, you only assign an IPv6 address to your bridge port. If you assign IPv6 addresses to your ethernet ports when they are bridged, your Edgerouter will get an IPv6 address, and it will be able to ping IPv6 addresses on the WAN, but no IPv6 traffic will get out from the LAN to the WAN. This cost me a lot of lost time as I tried to figure out why things weren’t working.

Before you go any further, make a backup of your current configuration! This will give you a way to roll back your changes. Changes must be made from the EdgeRouter CLI, in configure mode.

Here are the commands to issue, assuming eth0 is WAN, eth1 and eth2 are bridged LAN, and br0 is the bridge:

set interfaces ethernet eth0 dhcpv6-pd prefix-only
set interfaces ethernet eth0 dhcpv6-pd rapid-commit enable
set interfaces ethernet eth0 dhcpv6-pd pd 0 prefix-length 56
set interfaces ethernet eth0 dhcpv6-pd pd 0 interface br0 prefix-id :0
set interfaces ethernet eth0 dhcpv6-pd pd 0 interface br0 service slaac
set interfaces ethernet eth0 ipv6 router-advert managed-flag true
set interfaces ethernet eth0 ipv6 dup-addr-detect-transmits 1
commit

Give your EdgeRouter some time, as obtaining an IPv6 address is not always instantaneous. Eventually, your EdgeRouter dashboard should show an IPv6 address (as well as an IPv4 address, at least until you turn IPv4 off) attached to your bridge interface:

Edit – October 2017: If you’re not using your EdgeRouter in bridge mode (and I highly recommend not using your EdgeRouter in bridge mode, it really does slow down throughput), just replace the instances of ‘br0’ in the sample code above with the appropriate ‘eth<n>’.

Because IPv6 gives every device a (theoretically) routable address, you really should set up some firewall rules on the router. There is a basic ruleset that is widely available online, and which will provide you with some basic protection. To set this up, enter these commands:

set firewall ipv6-receive-redirects disable
set firewall ipv6-src-route disable
set firewall ipv6-name WAN6_IN default-action drop
set firewall ipv6-name WAN6_IN description "IPv6 packets from the internet to LAN and WAN"
set firewall ipv6-name WAN6_IN enable-default-log
set firewall ipv6-name WAN6_IN rule 10 action accept
set firewall ipv6-name WAN6_IN rule 10 state established enable
set firewall ipv6-name WAN6_IN rule 10 state related enable
set firewall ipv6-name WAN6_IN rule 10 description "Allow established and related packets"
set firewall ipv6-name WAN6_IN rule 20 action drop
set firewall ipv6-name WAN6_IN rule 20 log enable
set firewall ipv6-name WAN6_IN rule 20 state invalid enable
set firewall ipv6-name WAN6_IN rule 20 description "Drop invalid packets"
set firewall ipv6-name WAN6_IN rule 30 action accept
set firewall ipv6-name WAN6_IN rule 30 log enable
set firewall ipv6-name WAN6_IN rule 30 protocol icmpv6
set firewall ipv6-name WAN6_IN rule 30 description "Allow ICMPv6 packets"
set firewall ipv6-name WAN6_LOCAL default-action drop
set firewall ipv6-name WAN6_LOCAL description "IPv6 packets from internet to router"
set firewall ipv6-name WAN6_LOCAL enable-default-log
set firewall ipv6-name WAN6_LOCAL rule 10 action accept
set firewall ipv6-name WAN6_LOCAL rule 10 state established enable
set firewall ipv6-name WAN6_LOCAL rule 10 state related enable
set firewall ipv6-name WAN6_LOCAL rule 10 description "Allow established and related packets"
set firewall ipv6-name WAN6_LOCAL rule 20 action drop
set firewall ipv6-name WAN6_LOCAL rule 20 log enable
set firewall ipv6-name WAN6_LOCAL rule 20 state invalid enable
set firewall ipv6-name WAN6_LOCAL rule 20 description "Drop invalid packets"
set firewall ipv6-name WAN6_LOCAL rule 30 action accept
set firewall ipv6-name WAN6_LOCAL rule 30 log enable
set firewall ipv6-name WAN6_LOCAL rule 30 protocol icmpv6
set firewall ipv6-name WAN6_LOCAL rule 30 description "Allow ICMPv6 packets"
set firewall ipv6-name WAN6_LOCAL rule 40 action accept
set firewall ipv6-name WAN6_LOCAL rule 40 description "allow DHCPv6 client/server"
set firewall ipv6-name WAN6_LOCAL rule 40 destination port 546
set firewall ipv6-name WAN6_LOCAL rule 40 source port 547
set firewall ipv6-name WAN6_LOCAL rule 40 protocol udp
set interfaces ethernet eth0 firewall in ipv6-name WAN6_IN
set interfaces ethernet eth0 firewall local ipv6-name WAN6_LOCAL
commit

You can test IPv6 connectivity using ping6 (Google’s IPv6 DNS server 2001:4860:4860::8888 is a good test), or using the IPv6 test site. You should get a score of 10/10.

If anything went wrong, you can always return to your pre-IPv6 configuration by rebooting the router. If you are satisfied that the settings are working, save them using the save command.